. ESET researchers discovered a cyberattack that used a UEFI rootkit to establish a presence on the victims\u2019 computers. Dubbed LoJax by ESET, this rootkit was part of a campaign run by the infamous Sednit group against several high-profile targets in Central and Eastern Europe and is the first-ever publicly known attack of this kind.<\/p>\n\n\n\n
\u201cAlthough, in theory, we were aware that UEFI rootkits existed, our discovery confirms they are used by an active APT group. So they are no longer just an attractive topic at conferences, but a real threat,\u201d comments Jean-Ian Boutin, ESET senior security researcher who led the research into LoJax and Sednit\u2019s campaign.<\/p>\n\n\n\n
UEFI rootkits are extremely dangerous formidable tools for the launch of cyberattacks. They serve as a key to the whole computer, are hard to detect, and able to survive cybersecurity measures such as reinstallation of the operating system or even a hard disk replacement. Moreover, even cleaning a system that was infected with a UEFI rootkit requires knowledge well beyond the reach of a typical user, such as flashing the firmware.<\/p>\n\n\n\n
Sednit, also known as APT28, STRONTIUM, Sofacy or Fancy Bear, is one of the most active APT groups and has been operating since at least 2004. Allegedly, the Democratic National Committee hack that affected the 2016 US elections, the hacking of global television network TV5Monde, the World Anti-Doping Agency email leak, and many others are believed to be the work of Sednit.<\/p>\n\n\n\n
This group has in its arsenal a diversified set of malware tools, several examples of which ESET researchers have documented in their white paper as well as in numerous blogposts on WeLiveSecurity.<\/p>\n\n\n\n
The discovery of the first-ever in-the-wild UEFI rootkit serves as a wake-up call for users and their organizations who often ignore the risks connected with firmware modifications.<\/p>\n\n\n\n
\u201cNow there is no excuse for excluding firmware from regular scanning. Yes, UEFI-facilitated attacks are extremely rare, and up to now, they were mostly limited to physical tampering with the target computer. However, such an attack, should it succeed, would lead to the full control of a computer, with nearly total persistence,\u201d comments Jean-Ian Boutin.<\/p>\n\n\n\n
ESET is the only major provider of endpoint security solutions to add a dedicated layer of protection, ESET UEFI Scanner, designed to detect malicious components in a PC\u2019s firmware.<\/p>\n\n\n\n
\u201cThanks to the ESET UEFI Scanner, both our consumer and business customers are in a good position to spot such attacks and defend themselves against them,\u201d concludes Juraj Malcho, Chief Technology Officer at ESET.<\/p>\n\n\n\n
ESET\u2019s analysis of the Sednit campaign that uses the first-ever in-the-wild UEFI rootkit is described in the detail in the \u201cLoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group\u201d white paper.-82551922930<\/p>\n","protected":false},"excerpt":{"rendered":"
. ESET researchers discovered a cyberattack that used a UEFI rootkit to establish a presence on the victims\u2019 computers. Dubbed LoJax by ESET, this rootkit was part of a campaign run by the infamous Sednit group against several high-profile targets in Central and Eastern Europe and is the first-ever publicly known attack of this kind. […]<\/p>\n","protected":false},"author":2,"featured_media":1618,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-8721","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n